>3) Hard lockouts (rather than more nuanced rate limiting etc) requiring password resets. >4) Password reset options are weak and not protected. These are pre

>3) Hard lockouts (rather than more nuanced rate limiting etc) requiring password resets. >4) Password reset options are weak and not protected. These are pretty much impossible to both satisfy. At the end of the day you need to think of computer accounts as ephemeral or have some out of band access to the administrative staff.